!60 [sync] PR-59: fix CVE-2024-1682

From: @openeuler-sync-bot 
Reviewed-by: @sunsuwan 
Signed-off-by: @sunsuwan

Update-dependency-with-chardet.patch

@@ -0,0 +1,41 @@
+From 8cb31a4ce6b165795d049cbb278e20b14d53ed02 Mon Sep 17 00:00:00 2001
+From: starlet-dx <15929766099@163.com>
+Date: Sat, 5 Nov 2022 14:53:01 +0800
+Subject: [PATCH 1/1] Update Dependency with 'chardet>=3.0.2,<6'
+
+---
+ requests/__init__.py | 4 ++--
+ setup.py             | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/requests/__init__.py b/requests/__init__.py
+index 0ac7713..0708d11 100644
+--- a/requests/__init__.py
++++ b/requests/__init__.py
+@@ -74,8 +74,8 @@ def check_compatibility(urllib3_version, chardet_version, charset_normalizer_ver
+     if chardet_version:
+         major, minor, patch = chardet_version.split('.')[:3]
+         major, minor, patch = int(major), int(minor), int(patch)
+-        # chardet_version >= 3.0.2, < 5.0.0
+-        assert (3, 0, 2) <= (major, minor, patch) < (5, 0, 0)
++        # chardet_version >= 3.0.2, < 6.0.0
++        assert (3, 0, 2) <= (major, minor, patch) < (6, 0, 0)
+     elif charset_normalizer_version:
+         major, minor, patch = charset_normalizer_version.split('.')[:3]
+         major, minor, patch = int(major), int(minor), int(patch)
+diff --git a/setup.py b/setup.py
+index de86a91..5974e66 100755
+--- a/setup.py
++++ b/setup.py
+@@ -103,7 +103,7 @@ setup(
+         'security': [],
+         'socks': ['PySocks>=1.5.6, !=1.5.7'],
+         'socks:sys_platform == "win32" and python_version == "2.7"': ['win_inet_pton'],
+-        'use_chardet_on_py3': ['chardet>=3.0.2,<5']
++        'use_chardet_on_py3': ['chardet>=3.0.2,<6']
+     },
+     project_urls={
+         'Documentation': 'https://requests.readthedocs.io',
+-- 
+2.30.0
+

backport-CVE-2023-32681.patch

@@ -0,0 +1,62 @@
+From 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 Mon Sep 17 00:00:00 2001
+From: Nate Prewitt <nate.prewitt@gmail.com>
+Date: Mon, 22 May 2023 08:08:57 -0700
+Subject: [PATCH] Merge pull request from GHSA-j8r2-6x86-q33q
+
+Reference:https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5
+Conflict:Adaptation Context
+
+---
+ requests/sessions.py   |  4 +++-
+ tests/test_requests.py | 20 ++++++++++++++++++++
+ 2 files changed, 23 insertions(+), 1 deletions(-)
+
+diff --git a/requests/sessions.py b/requests/sessions.py
+index ae4bcc8..fe0370d 100644
+--- a/requests/sessions.py
++++ b/requests/sessions.py
+@@ -306,7 +306,9 @@ class SessionRedirectMixin(object):
+         except KeyError:
+             username, password = None, None
+ 
+-        if username and password:
++        # urllib3 handles proxy authorization for us in the standard adapter.
++        # Avoid appending this to TLS tunneled requests where it may be leaked.
++        if not scheme.startswith('https') and username and password:
+             headers['Proxy-Authorization'] = _basic_auth_str(username, password)
+ 
+         return new_proxies
+diff --git a/tests/test_requests.py b/tests/test_requests.py
+index c4abe39..40292ac 100644
+--- a/tests/test_requests.py
++++ b/tests/test_requests.py
+@@ -590,6 +590,26 @@ class TestRequests:
+                 session = requests.Session()
+                 session.request(method='GET', url=httpbin())
+ 
++
++    @pytest.mark.parametrize(
++        "url,has_proxy_auth",
++        (
++            ('http://example.com', True),
++            ('https://example.com', False),
++        ),
++    )
++    def test_proxy_authorization_not_appended_to_https_request(self, url, has_proxy_auth):
++        session = requests.Session()
++        proxies = {
++            'http': 'http://test:pass@localhost:8080',
++            'https': 'http://test:pass@localhost:8090',
++        }
++        req = requests.Request('GET', url)
++        prep = req.prepare()
++        session.rebuild_proxies(prep, proxies)
++
++        assert ('Proxy-Authorization' in prep.headers) is has_proxy_auth
++
+     def test_basicauth_with_netrc(self, httpbin):
+         auth = ('user', 'pass')
+         wrong_auth = ('wronguser', 'wrongpass')
+-- 
+2.33.0
+

backport-CVE-2024-1682.patch

@@ -0,0 +1,40 @@
+From 6106a63eb6c0fa490efa73d44388ac25b1b08af4 Mon Sep 17 00:00:00 2001
+From: Nate Prewitt <nate.prewitt@gmail.com>
+Date: Tue, 20 Feb 2024 11:58:35 -0800
+Subject: [PATCH] Cleanup defunct links from community docs page
+
+Reference:https://github.com/psf/requests/commit/6106a63eb6c0fa490efa73d44388ac25b1b08af4
+Conflict:NA
+
+---
+ docs/community/out-there.rst | 14 +-------------
+ 1 file changed, 1 insertion(+), 13 deletions(-)
+
+diff --git a/docs/community/out-there.rst b/docs/community/out-there.rst
+index c33ab3c95b..c75c71f6a2 100644
+--- a/docs/community/out-there.rst
++++ b/docs/community/out-there.rst
+@@ -1,22 +1,10 @@
+ Integrations
+ ============
+ 
+-Python for iOS
+---------------
+-
+-Requests is built into the wonderful `Python for iOS <https://itunes.apple.com/us/app/python-2.7-for-ios/id485729872?mt=Python8>`_ runtime!
+-
+-To give it a try, simply::
+-
+-    import requests
+-
+-
+ Articles & Talks
+ ================
+-- `Python for the Web <https://www.gun.io/blog/python-for-the-web>`_ teaches how to use Python to interact with the web, using Requests.
+ - `Daniel Greenfeld's Review of Requests <https://pydanny.blogspot.com/2011/05/python-http-requests-for-humans.html>`_
+-- `My 'Python for Humans' talk <http://python-for-humans.heroku.com>`_ ( `audio <https://codeconf.s3.amazonaws.com/2011/pycodeconf/talks/PyCodeConf2011%20-%20Kenneth%20Reitz.m4a>`_ )
+-- `Issac Kelly's 'Consuming Web APIs' talk <https://issackelly.github.com/Consuming-Web-APIs-with-Python-Talk/slides/slides.html>`_
++- `Issac Kelly's 'Consuming Web APIs' talk <https://issackelly.github.io/Consuming-Web-APIs-with-Python-Talk/slides/slides.html>`_
+ - `Blog post about Requests via Yum <https://arunsag.wordpress.com/2011/08/17/new-package-python-requests-http-for-humans/>`_
+ - `Russian blog post introducing Requests <https://habr.com/post/126262/>`_
+ - `Sending JSON in Requests <http://www.coglib.com/~icordasc/blog/2014/11/sending-json-in-requests.html>`_

python-requests.spec

@@ -2,7 +2,7 @@
 
 Name:           python-requests
 Version:        2.26.0
-Release:        5
+Release:        9
 Summary:        Python HTTP Library
 License:        ASL 2.0
 URL:            http://python-requests.org/
@@ -12,6 +12,9 @@ Patch1:         requests-2.12.4-tests_nonet.patch
 Patch2:         requests-2.20.0-no-py2-httpbin.patch
 Patch3:         patch-requests-certs.py-to-use-the-system-CA-bundle.patch
 Patch4:         Remove-tests-that-use-the-tarpit.patch
+Patch5:         Update-dependency-with-chardet.patch
+Patch6000:      backport-CVE-2023-32681.patch
+Patch6001:      backport-CVE-2024-1682.patch
 
 BuildArch:      noarch
 
@@ -95,7 +98,19 @@ PYTHONPATH=%{buildroot}%{python3_sitelib} %{__python3} -m pytest -v
 %doc HISTORY.md README.md
 
 %changelog
-* Tue Jan 11 2021 zhujunhao <zhujunhao8@huawei.com> - 2.26.0-5
+* Mon Nov 18 2024 zhangpan <zhangpan103@h-partners.com> - 2.26.0-9
+- fix CVE-2024-1682
+
+* Wed May 31 2023 zhangpan <zhangpan103@h-partners.com> - 2.26.0-8
+- fix CVE-2023-32681
+
+* Sat Nov 05 2022 yaoxin <yaoxin30@h-partners.com> - 2.26.0-7
+- Fix the mailman build error caused by the python-chardet update.
+
+* Tue Oct 25 2022 wangkerong <wangkerong@h-partners.com> - 2.26.0-6
+- rebuild for next release
+
+* Tue Jan 11 2022 zhujunhao <zhujunhao8@huawei.com> - 2.26.0-5
 - modify build failed
 
 * Thu Dec 30 2021 yangcheng <yangcheng87@huawei.com> - 2.26.0-4